TryHackMe — Web App PenTest: NoSQL Injection

[embed]

[embed]NoSQL Injection A walkthrough depicting basic NoSQL injections on MongoDB.tryhackme.com

Learning Objectives

• Understand what NoSQL is
• Understand how NoSQL databases work, store data, and are interfaced with
• Learn about the different types of NoSQL injection attacks
• Learn how to practically exploit a NoSQL injection vulnerability

What is NoSQL?

NoSQL is non-relational database that stores data in an ordered way.

• Documents: equivalent to rows/entries in relational DB.
• Collections: equivalent to tables in relational DB
• Databases: equivalent to databases in relational DB

Query the Database

Using the above collection as an example.

• To retrieve the document whose last name is Sandler

['last_name' => 'Sandler']

• To retrieve the document who is male and his last name is Phillips

['getnder' => 'maile', 'last_name' => 'Phillips']

• To retrieve the documents wher ethe age is less than 50

['age' => ['$lt' => '50']]

NoSQL Injection

There are two types of NoSQL Injections: Syntax Injection and Operator Injection.

Syntax Injection

• Similar to relational SQL Injection where we exploit the syntax to break out of the query and inject payloads.
• Uncommon as most libraires used to create queries apply filters that prevent us from injecting into the syntax.

Operator Injection

• We potentially inject a NoSQL query operator that manipulates the query’s behaviors, hence allowing us to bypass the authentication.

How to Inject NoSQL

• Unlike relational SQL where queries are concatenated strings, NoSQL queries require nested associated arrays -> must inject arrays into the application.
• In a regular application, the document is retrieved through codes that look like this

['username' => $user, 'password' => $pass]

• If we inject **[‘$ne’ => ‘xxxx’] and `[‘$ne’ => ‘yyyy’]`, **we have the following:

• The resulting filter look like:

• This tricks the DB to return anything whose username is not **xxxx and the password is not yyyy.**
• In many program languages, we’re given an option to pass an array as part of a POST request:

Bypassing the Login Screen

• To bypass the Login screen, we can modify the POST data in Burp Suite.

user[$ne]=asdsa&password[$ne]=asdf

• This forces the database to return all user documents and as a result, we are logged in the application as the first user returned by the database

Log in as other users

• **$nin **is an operator that allows us to create a filter by specifying criteria where the desired documents do not have any fields containing the listed value.
• The **$in** receives a list of values to ignore.

user[$nin][]=admin&password[$ne]=asdczs

• This translates into the following query:

• To add multiple values to the list, we deliver the following data

user[$nin][]=admin&user[$nin][]=jude&password[$ne]=asdczs

• This translates into

We will be logged in with whatever user first returned by the database thats not in the list.

Find password length

• We use regex to check for the password length.

user=admin&password[$regex]=^.{7}$

• The regex **^.{7}$** basically matches any string of length 7. If the password is not 7 characters long, the application will return some errors.
• We can brute force the length until we don’t get the error. That’s how we confirm the length of the user’s password.

Extract user’s password

• Once we find the password length, we can extract the password using similar technique.

user=admin&password[$regex]=^a.......$

• The regex **^a…….$ looks for any string that is 7 characters long and starts with `a**. If the first character is nota`, we will see some errors from the application. Brute force this until we don’t get any error on the application.
• We continue doing this for the remaining positions of the password.

Syntax Injection: Identification and Data Extraction

• Even though it is uncommon to find syntax injection vulnerability in NoSQL, it is worth checking for it.
• We can try admin' to see how the application responds.
• Some other payloads to try: **admin’ && 0 && ‘x, `admin’ && 1 && ‘x**,admin’||1||’`

ANSWER THE QUESTIONS

What is a group of documents in MongoDB is known as?

collection

Using the MongoDB Operator Reference, what operator is used to filter data when a field isn’t equal to a given value?

$ne

Following the example of the 3 documents given before, how many documents would be returned by the following filter: [‘gender’ => [‘$ne’ => ‘female’] , ‘age’ => [‘$gt’=>’65'] ]?

0

What type of NoSQL Injection is similar to normal SQL Injection?

Syntax

What type of NoSQL Injection allows you to modify the behaviour of the query, even if you can’t escape the syntax?

Operator

When bypassing the login screen using the $ne operator, what is the email of the user that you are logged in as?

admin@nosql.int

How many users are there in total?

4

There is a user that starts with the letter “p”. What is his username?

pedro

What is john’s password?

10584312

One of the users seems to be reusing his password for many services. Find which one and connect through SSH to retrieve the final flag!

flag{N0Sql_n01iF3!}

What common character is used to test for injection in both SQL and NoSQL solutions?

‘

What is the email value of the super secret user returned in the last entry?

Syntax@Injection.FTW

Conclusion

That’s it for the post today. Clap if you like this post, and don’t forget to follow me for more cybersecurity contents.